-ikiwiki (3.20170109) UNRELEASED; urgency=medium
+ikiwiki (3.20170112) UNRELEASED; urgency=medium
+
+ * t/git-cgi.t: Wait 1 second before doing a revert that should work.
+ This hopefully fixes a race condition in which the test failed
+ around 6% of the time. (Closes: 862494)
+
+ -- Simon McVittie <smcv@debian.org> Sun, 14 May 2017 15:34:52 +0100
+
+ikiwiki (3.20170111) unstable; urgency=high
+
+ * passwordauth: prevent authentication bypass via multiple name
+ parameters (CVE-2017-0356, OVE-20170111-0001)
+ * passwordauth: avoid userinfo forgery via repeated email parameter
+ (also in the scope of CVE-2017-0356)
+ * CGI, attachment, passwordauth: harden against repeated parameters
+ (not believed to have been a vulnerability)
+ * remove: make it clearer that repeated page parameter is OK here
+ * t/passwordauth.t: new automated test for passwordauth
+
+ -- Simon McVittie <smcv@debian.org> Wed, 11 Jan 2017 18:16:53 +0000
+
+ikiwiki (3.20170110) unstable; urgency=medium
[ Amitai Schleier ]
* wrappers: Correctly escape quotes in git_wrapper_background_command
build-dependency, with virtual package libmagickcore-extra as an
alternative, to help autopkgtest to do the right thing
- -- Simon McVittie <smcv@debian.org> Mon, 09 Jan 2017 14:33:19 +0000
+ -- Simon McVittie <smcv@debian.org> Tue, 10 Jan 2017 13:22:01 +0000
ikiwiki (3.20161229.1) unstable; urgency=medium